On Debian, session.gc_probability in php.ini is set to 0, so session files will be removed by the built in Debian cron job, but the path for php session files has been modified in eZ Publish 5.3, files are now stored outside the cache folder, because of this, the cron job will not be able to remove session files (default php session files are in /var/lib/php5)

Now as stated in the documentation (https://doc.ez.no/display/EZP/Session) default Symfony configuration will enable framework.session.gc_probability, apparently this is not the case,
framework.session.gc_probability is not enabled after a default installation.