CompatHub
Check EOL

Apache Tomcat 9.0 lifecycle

Current status

standard supportlow

Apache Tomcat 9.0 is currently in standard support.

Security: 2 tracked advisories affecting this line · 1 in CISA KEV. Details below — lifecycle and vulnerability status are separate.

Official lifecycle source: Apache Tomcat whichversion

Support phase
standard support
End of life
31 Mar 2027
Latest release
9.0.121
Released
18 Aug 2026

At a glance

Version line
9.0
Initial release
4 Oct 2017
Lifecycle phase
standard support
Latest stable
9.0.121
Latest release date
18 Aug 2026
EOL
31 Mar 2027
Until EOL
~7 months
Risk
low
Releases tracked
122

Lifecycle timeline

Phases from published LifecyclePeriod records. Missing phases are not inferred.

  1. Release

    4 Oct 2017

  2. standard supportcurrent

    4 Oct 2017 → 31 Mar 2027

    Source: Apache Tomcat whichversion

Apache Tomcat 9.0 is currently in standard support.

Upgrade options

Newer supported Apache Tomcat version lines from CompatHub lifecycle data. Compatibility and security context use existing evidence only.

You are on Apache Tomcat 9.0

SupportedEOL 31 March 2027

Supported upgrade options

Open full upgrade planner for Apache Tomcat 9.0 →

Known exploited vulnerabilities

CVE entries that CISA lists in the Known Exploited Vulnerabilities catalogue, including due dates and ransomware use when published. CVSS shown when NVD enrichment is available.

  • CVE-2023-44487Known exploited

    HTTP/2 Rapid Reset Attack Vulnerability

    CISA KEV:
    listed · added 2023-10-10 · due 2023-10-31
    Required action:
    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    Affected:
    <10.5.3; <9.4.0
    Fixed in:
    10.5.3, 9.4.0
    Source:
    CISA KEV · Advisory

Security

Advisories affecting Apache Tomcat 9.0 (OSV.dev evidence). Known exploited status, due dates, and ransomware use from CISA KEV when matched.

Known vulnerabilities
2
Known exploited
1
Highest CVSS
—
  • CVE-2023-44487Known exploited

    HTTP/2 Rapid Reset Attack Vulnerability

    CISA KEV:
    listed · added 2023-10-10 · due 2023-10-31
    Required action:
    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    Affected:
    <10.5.3; <9.4.0
    Fixed in:
    10.5.3, 9.4.0
    Source:
    CISA KEV · Advisory
  • CVE-2021-33037
    Affected:
    <=10.0.6
    Source:
    OSV source · Advisory

Runtime compatibility

OpenJDK versions compatible with Apache Tomcat 9.0, derived from official Java version requirements from vendor documentation.

All OpenJDK lines →

Latest release

9.0.121

Released 18 Aug 2026 · stable

https://archive.apache.org/dist/tomcat/tomcat-9/v9.0.121/

Previous releases

  • 9.0.120

    7 Jul 2026

  • 9.0.119

    23 Jun 2026

  • 9.0.118

    10 May 2026

Release history

122 concrete releases tracked for this line.

VersionRelease dateChannelSource
9.0.7113 Jan 2023stableSource
9.0.705 Dec 2022stableSource
9.0.6914 Nov 2022stableSource
9.0.687 Oct 2022stableSource
9.0.6726 Sept 2022stableSource
9.0.66—stableSource
9.0.6520 Jul 2022stableSource
9.0.6417 Jun 2022stableSource
9.0.6316 May 2022stableSource
9.0.621 Apr 2022stableSource
9.0.61—stableSource
9.0.6014 Mar 2022stableSource
9.0.5928 Feb 2022stableSource
9.0.5820 Jan 2022stableSource
9.0.57—stableSource
9.0.568 Dec 2021stableSource
9.0.5515 Nov 2021stableSource
9.0.541 Oct 2021stableSource
9.0.5310 Sept 2021stableSource
9.0.526 Aug 2021stableSource
9.0.51—stableSource
9.0.502 Jul 2021stableSource
9.0.49—stableSource
9.0.4815 Jun 2021stableSource
9.0.47—stableSource

Release activity

Total releases
122
Last 30 days
1
Last 90 days
3
Avg. interval
~29 days
Most recent
18 Aug 2026

Should I use this version?

Suitable for new deployments

Apache Tomcat 9.0 is currently supported (standard support).

Version comparison

Compact comparison against the nearest relevant release lines.

9.011.0
Statusstandard supportstandard support
Latest release9.0.12111.0.25
EOLMar 2027Not published
Risklowlow

Compatibility

Evidence-backed compatibility results involving Apache Tomcat 9.0. Only combinations CompatHub can evaluate from upstream sources are listed.

Compatible targets

Open Compatibility Explorer →

Sources

Where this information comes from.

Lifecycle sources

Release sources

Data coverage

Last checked = last successful upstream check. Latest source update = when upstream content last changed.

Releases tracked
122
Lifecycle periods
1
EOL
Known
Provenance records
2
Data last checked
1 Sept 2026
Latest source update
1 Sept 2026

Other Apache Tomcat versions