Apache Tomcat 9.0 lifecycle

At a glance

Version line

9.0

Initial release

4 Oct 2017

Lifecycle phase

standard support

Latest stable

9.0.121

Latest release date

18 Aug 2026

EOL

31 Mar 2027

Until EOL

~7 months

Risk

low

Releases tracked

122

1. Release

   4 Oct 2017

2. standard supportcurrent

   4 Oct 2017 → 31 Mar 2027

   Source: Apache Tomcat whichversion

Apache Tomcat 9.0 is currently in standard support.

• CVE-2023-44487Known exploited

  HTTP/2 Rapid Reset Attack Vulnerability

  CISA KEV:

  listed · added 2023-10-10 · due 2023-10-31

  Required action:

  Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  Affected:

  <10.5.3; <9.4.0

  Fixed in:

  10.5.3, 9.4.0

  Source:

  CISA KEV · Advisory

Known vulnerabilities

2

Known exploited

1

Highest CVSS

—

• CVE-2023-44487Known exploited

  HTTP/2 Rapid Reset Attack Vulnerability

  CISA KEV:

  listed · added 2023-10-10 · due 2023-10-31

  Required action:

  Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  Affected:

  <10.5.3; <9.4.0

  Fixed in:

  10.5.3, 9.4.0

  Source:

  CISA KEV · Advisory

• CVE-2021-33037

  Affected:

  <=10.0.6

  Source:

  OSV source · Advisory

Total releases

122

Last 30 days

1

Last 90 days

3

Avg. interval

~29 days

Most recent

18 Aug 2026

Releases tracked

122

Lifecycle periods

1

EOL

Known

Provenance records

2

Data last checked

1 Sept 2026

Latest source update

1 Sept 2026

• Previous

  Apache Tomcat 8.5

  end of life · EOL 31 Mar 2024

• Next

  Apache Tomcat 10.0

  end of life · EOL 31 Oct 2022

• Newest supported

  Apache Tomcat 11.0

  standard support