[ANN] Apache Tomcat 9.0.116 available

Rémy Maucherat <[email protected]> Fri, 20 Mar 2026 15:52:50 +0100

Newsgroups	gmane.comp.java.hadoop.zookeeper.devel,gmane.comp.jakarta.tomcat.user,gmane.comp.apache.maven.announce
Message-ID	<CANwj8ZpwiXOYpyXYz7d45HDLNMjZhQ31dDsjJQ8kx=-82bD1-g__20.6128040858289$1774018419$gmane$org@mail.gmail.com>

The Apache Tomcat team announces the immediate availability of Apache
Tomcat 9.0.116.

Apache Tomcat 9 is an open source software implementation of the Java
Servlet, JavaServer Pages, Java Unified Expression Language, Java
WebSocket and JASPIC technologies.

Apache Tomcat 9.0.116 is a bugfix and feature release. The notable
changes compared to 9.0.115 include:

- Relax HTTP/2 header validation and respond to invalid requests with
   a stream reset or a 400 response as appropriate rather than with a
   connection reset.

- Fix bug 69964: Respect the configured cipher order, which was no
   longer respected following the addition of TLS 1.3 specific cipher
   configuration. TLS 1.3 ciphers will always be first in the list.

- Update Tomcat Native to 1.3.7 / 2.0.14 and increase the recommended
   version to 1.3.7 / 2.0.14.

Along with lots of other bug fixes and improvements.

Please refer to the change log for the complete list of changes:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html

Downloads:
https://tomcat.apache.org/download-90.cgi

Migration guides from Apache Tomcat 7.x and 8.x:
https://tomcat.apache.org/migration.html

Enjoy!

- The Apache Tomcat team