Tomcat Versions: Releases & End of Life Dates

This is a reference list of every Apache Tomcat version — the same table our Tomcat support engineers work from when assessing an estate. It covers Tomcat 7 through Tomcat 11, with servlet and JSP spec levels, minimum Java requirements, current releases, and end-of-life status. All data comes from the Apache Software Foundation's official which-version page and the announcements on tomcat.apache.org.

Tomcat versions list: spec levels, Java requirements, and status

Each Tomcat major version implements a fixed set of Jakarta EE (formerly Java EE) specifications. The spec level is what determines application compatibility, not the Tomcat version number itself.

The javax to jakarta break: why 9 to 10 is different

The jump from Tomcat 9 to Tomcat 10 is not a normal version upgrade. Tomcat 10.0 and later implement Jakarta EE, and Jakarta EE 9 renamed every specification package from javax.* to jakarta.*. An application compiled against javax.servlet.http.HttpServletRequest will not run on Tomcat 10 or later without change — the class names the container provides are different. This is an application code change, not a configuration change.

The ASF publishes the Tomcat 10 migration guide and maintains the Apache Tomcat Migration Tool for Jakarta EE, which rewrites javax.* references to jakarta.* in a WAR file at the bytecode level. The tool handles most applications; anything using reflection against spec class names or bundling its own servlet API copies needs manual work. Applications you cannot modify or re-process stay on Tomcat 9 — which is why the Tomcat 9 EOL date matters more than any other date in the table above.

Tomcat 9 end of life

The ASF has announced that support for Apache Tomcat 9.0.x ends on March 31, 2027. The announcement is posted on the Tomcat home page. Until that date, 9.0.x continues to receive regular releases — 9.0.120 shipped in July 2026 with the same fixes as the 10.1 and 11.0 releases of the same cycle.

Tomcat 9 is the last branch that implements Java EE 8 with the javax.* namespace, which is why it has remained in support far longer than a typical branch. When it ends, every javax-based application loses its supported container. Teams running Tomcat 9 have until March 2027 to either migrate applications to the jakarta namespace and move to 10.1 or 11, or accept running an unpatched container.

Tomcat 10.0 is already end of life

Tomcat 10.0.x reached end of life on October 31, 2022, per the ASF's Tomcat 10.0 EOL notice. It was a short-lived branch: 10.0 implemented Jakarta EE 9, which existed mainly to execute the namespace rename, and 10.1 (Jakarta EE 10) superseded it quickly. Anything still on 10.0.x should move to 10.1.x — the namespace is the same, so this upgrade does not require application changes the way 9 to 10 does.

How ASF end of life works

The ASF does not publish a fixed support schedule for Tomcat the way Microsoft or Oracle do. A branch is supported for as long as the project chooses to cut releases from it. When the project decides to retire a branch, it announces an end-of-support date roughly a year in advance — the pattern held for 8.5 (announced ahead of March 31, 2024) and 7.0 (March 31, 2021), and the Tomcat 9 announcement follows it. After the date, the branch gets no releases of any kind and downloads move to the archive. There is no paid extended support program from the ASF; commercial vendors fill that gap independently.

How to check your Tomcat version

Every Tomcat install ships a version script in the bin directory. On Linux:

$CATALINA_HOME/bin/version.sh

On Windows:

%CATALINA_HOME%inersion.bat

The output reports the exact server version, build date, and the JVM it is running on. If the scripts are unavailable — some packaged installs strip them — run java -cp lib/catalina.jar org.apache.catalina.util.ServerInfo from the Tomcat home directory. Match the version against the table above; the third number identifies the patch level within the branch, and only the latest patch of a supported branch contains all current security fixes.

Upgrade paths

Within a branch (9.0.100 to 9.0.120, 10.1.x to newer 10.1.x), upgrades are drop-in: replace the binaries, keep conf, restart. Across major versions, the deciding factor is the namespace boundary:

• 8.5 or 9.0 to 10.1/11.0: requires the javax to jakarta application migration. Re-process WARs with the Apache migration tool or rebuild against Jakarta APIs, then deploy on the new container. Test filters, listeners, and any bundled libraries that embed servlet API references.
• 10.1 to 11.0: same namespace, spec-level bump (Jakarta EE 10 to 11) plus the Java 17 minimum. Most applications move without code changes; verify the JVM first.
• 8.0/7.0 to anything: these branches are years past EOL. Go directly to 9.0 as a stopgap if the application cannot be touched before March 2027, or to 10.1/11.0 with the namespace migration if it can.

If the estate is large, inventory first: which branch each instance runs, which applications carry javax references, and which vendors have Jakarta-ready builds. That inventory dictates whether March 2027 is a routine patch cycle or a migration project. Our application server support practice runs this assessment for Tomcat, JBoss, and WebLogic estates.

Security exposure on end-of-life versions

Vulnerabilities disclosed after a branch's EOL date are not fixed in that branch, and the ASF's security pages stop tracking it. Fixes for issues found in supported branches frequently apply to the same code present in retired ones, so an EOL Tomcat accumulates known, unpatched, publicly documented vulnerabilities over time. The authoritative per-branch vulnerability lists are the ASF security pages: Tomcat 9, Tomcat 10, and Tomcat 11. A Tomcat 8.5 or 7.0 instance reachable from a network is a standard penetration-test finding. For background on the platform itself, see our Apache Tomcat overview.

FAQ

What is the latest version of Tomcat?

Tomcat 11.0 (currently 11.0.24), implementing Jakarta EE 11 on Java 17 or later. Tomcat 10.1 remains fully supported in parallel.

Is Tomcat 9 still supported?

Yes. Tomcat 9.0.x continues to receive releases, and the ASF has announced its end of support for March 31, 2027.

Which Tomcat versions are end of life?

Tomcat 10.0 (October 31, 2022), 8.5 (March 31, 2024), 8.0 (June 30, 2018), 7.0 (March 31, 2021), and everything earlier. None receive security fixes.

Can I run a javax application on Tomcat 10 or 11?

Not directly. Tomcat 10.0 and later use the jakarta.* namespace. The application must be migrated — rebuilt against Jakarta APIs or converted with the Apache Tomcat Migration Tool for Jakarta EE.