If I change the value of session timeout in web.xml, Undertow doesn't handle it. I'm attaching a simple app to test with.

Just build the WAR and hit http://localhost:8080/war-leak/main.jsf. You will see a message in the main console when the HttpSessionListener is notified about the session creation. However, the session timeout is set to 1 minute in web.xml. Wait a couple of minutes and you will not see where the HttpSessionListener was notified about session destroyed.

This app works as expected using JBoss Web.