Keep Legacy Jetty and CometD Secure After EOL with TuxCare

Go straight to an AI summary of this blog post instead

Jetty 9–11 and CometD 5–7 reach End of Life (EOL) on January 1, 2026, ending public updates and security patches from Webtide.
TuxCare and Webtide have partnered to offer Endless Lifecycle Support for Jetty and CometD, extending security maintenance for these legacy versions.
TuxCare ELS provides continuous CVE patching, complete dependency coverage, and supply-chain assurance, keeping production systems secure long after public support ends.

For nearly two decades, Eclipse Jetty and CometD have powered high-performance web applications worldwide, and both projects continue to evolve today with the latest releases, Jetty 12.1 and CometD 9.

However, the teams at Webtide, who steward both projects, have announced that older versions, specifically Jetty 9, 10, and 11, and CometD 5, 6, and 7, will officially reach end of life (EOL) on January 1, 2026.

This doesn’t mean Jetty or CometD themselves are going away — far from it. The projects remain active and supported. But these legacy versions will no longer receive security patches or CVE fixes from the open-source community once they pass EOL.

If your production workloads still rely on these versions, this change is more than a milestone; it’s a moment to plan your next move.

What the Jetty and CometD EOL Announcement Really Means

For 18 years, Webtide has provided development, support, and security maintenance for Jetty and CometD. With innovation now focused on modern versions, the maintainers are sunsetting older branches to streamline ongoing development.

Here’s what changes on January 1, 2026:

Webtide will stop publishing new releases for Jetty 9, 10, and 11, and CometD 5, 6, and 7 to Maven Central and other public repositories.
These specific versions will no longer receive public updates or security fixes after that date.
Looking ahead, future major Jetty and CometD versions will follow a policy of receiving six months of CVE coverage after their EOL, before public maintenance ends.

Starting January 1, 2026, production systems still running Jetty 9–11 or CometD 5–7 will need an alternative source of ongoing security maintenance to remain protected.

You can also learn more about Eclipse Jetty EOL timeline details and version impact in our in-depth guide.

Why Upgrading Isn’t Always Immediate

Upgrading from older Jetty or CometD versions to the latest releases is the ideal long-term path. However, in enterprise environments, upgrades can take considerable time.

Legacy dependencies, regulatory constraints, and integration complexity often make immediate upgrades unrealistic. Yet delaying upgrades without security coverage leaves systems exposed.

Recognizing this challenge, Webtide has officially partnered with TuxCare to provide a trusted path forward. Through this partnership, TuxCare’s Endless Lifecycle Support (ELS) delivers ongoing security maintenance for legacy Jetty and CometD versions after their public EOL date.

This means organizations can continue to operate securely and in compliance while planning and testing their upgrade, without rushing the process or accepting unnecessary risk.

Why TuxCare ELS Is a Pragmatic Choice

TuxCare’s Endless Lifecycle Support provides a sustainable way to maintain the security of your legacy software versions while you prepare for future upgrades or migrations.

Here’s what you get:

Continued CVE patching after the EOL date for Jetty 9, 10, and 11 and CometD 5, 6, and 7, ensuring your legacy environments stay protected.
Comprehensive coverage, including security fixes for all direct and transitive dependencies your Jetty or CometD deployments rely on.
Endless support with maintenance continuing for as long as your organization requires.
Trusted software supply chain, supported by Software Bills of Materials (SBOMs) and Vulnerability Exploitability eXchange (VEX) files, with SLSA Level 3 compliance on the roadmap to strengthen supply-chain assurance.

With ELS, you get long-term stability and complete visibility into your security posture, all while preserving the compatibility of your existing deployments.

Secure Today, Upgrade Tomorrow with TuxCare

Jetty and CometD remain vibrant, actively maintained open-source projects; however, their older versions are nearing the end of public support.

If your systems are still running Jetty 9–11 or CometD 5–7, TuxCare’s Endless Lifecycle Support ensures you can continue operating securely and confidently well beyond January 1, 2026.

TuxCare helps you protect your production environments, maintain their compliance and compatibility, and plan the upgrade on your schedule without compromising uptime or security.

👉 Learn more about TuxCare’s Endless Lifecycle Support for Jetty

👉 Learn more about Endless Lifecycle Support for CometD

Keep your applications running. Keep them secure. Keep moving forward with TuxCare.

Summary