There is no connection timeout for the internal http server (REST/RPC).
Malfunction clients could produce zombi-idling rpc threads.
I had a look at it and there would be need to change the current implementation to do it async (something like boost::asio async). Currently it's a getline() on the raw stream.

A good starting point could be: http://www.boost.org/doc/libs/1_45_0/doc/html/boost_asio/example/timeouts/async_tcp_client.cpp