Websocket sessions are not GC'd on close. This will quickly lead to out-of-memory condition, and server hang. I have marked this is a blocker as any application that uses Websockets will have this issue, and there is no workaround; it is not a corner case.
To reproduce, create a Websocket handler, and index.html to create the socket. See below. Load index.html in a browser, and refresh the page several times.
Using VisualVM (or other memory profiler), search for websocket in the heap dump. You should find that every refresh of the page will cause an additional instance of WsSession, and other supporting classes.
These instances are referenced by org.apache.openejb.core.WebContext / creationalContexts, and do not appear to be removed when the websocket is closed.
Amend the ws://localhost:8080/WebsockMemleak/ws url in the source below, to match your context root / port number.