Default session timeout is set to 30 minutes, you can verify it calling getMaxInactiveInterval() method.
Using setMaxInactiveInterval(-1) indicates that the Session should never timeout. Keep in mind that you also need to overwrite the JSESSIONID cookie MaxAge to prevent to lose the Session when the browser is closed.
The impact depends on the application that you have deployed.