Apache Tomcat 9 reached end of life on December 31, 2025 . No more security patches. No more CVE fixes. Every vulnerability disclosed from January 1, 2026 onward is permanently unpatched on Tomcat 9.

And yet — tens of thousands of production servers are still running it today.

This isn't negligence. There's a specific technical reason teams stay stuck, and it's worth understanding before you plan your migration.

Complete Tomcat EOL Schedule

Version Servlet Spec End of Life Status

Tomcat 7 3.0 Mar 31, 2021 ❌ EOL

Tomcat 8.5 3.1 Mar 31, 2024 ❌ EOL

Tomcat 9 4.0 Dec 31, 2025 ❌ EOL

Tomcat 10.1 6.0 (Jakarta) Dec 31, 2026 ⚠️ Warning

Tomcat 11 6.1 (Jakarta) TBD ✅ Supported

Why Tomcat 9 is the Stickiest EOL Version

Tomcat 9 was the last version to use the javax.* namespace . Tomcat 10 and later use the jakarta.* namespace — a breaking change introduced with Jakarta EE 9.

This means migrating from Tomcat 9 to Tomcat 10+ is not a drop-in upgrade .…