I'm attaching a test case that reproduces the hang. See the README inside the zip about how to execute it.
The annotator (ForwardJCas) consists of a simple CAS multiplier with delays in it scaled out in its own thread within 2 levels of aggregates. It receives a CAS, sleeps for 3 seconds, gets a new empty CAS, copies information into it, sleeps again, and then returns the CAS. The unit test (UimaAsTest) initializes 40 UIMA-AS clients with a timeout of 8 seconds, send 1 CAS from each to the service, and then waits. After 1-2 runs, the CAS multiplier winds up hanging on the getEmptyCas() call in the scaled out annotator.
What appears to be happening is that free CAS messages are not being sent from the client to the service in all cases when the timeouts occur. A similar defect (https://issues.apache.org/jira/browse/UIMA-1786) was fixed in 2.3.1 with slightly different symptoms.