For the example QueryParam into "incoming:"
@QueryParam("foo") String incoming;

This ought be a valid query string:
/endpoint?foo=weird=but=valid&bar=randal

The bug is that instead of "incoming" being "weird=but=valid", "incoming"'s value is truncated down to "weird".

As for "why," this somewhat weird url usage is required to implement a server side version of the "AfterQuery" selection engine: https://github.com/apenwarr/afterquery/blob/master/help.md