rewrite handler produces invalid URLs when used with query part

Undertow configuration (relevant parts only): <subsystem xmlns= "urn:jboss:domain:undertow:3.1" > <buffer-cache name= " default " /> <server name= " default -server" > <http-listener name= " default " socket-binding= "http" redirect-socket= "https" enable-http2= " true " /> <https-listener name= "https" socket-binding= "https" security-realm= "ApplicationRealm" enable-http2= " true " /> <host name= " default -host" alias= "localhost, home" > <access-log pattern= "Def: %h %t %v &quot;%r&quot; %s " use-server-log= " true " /> <filter-ref name= "to-query0" predicate= "regex( '^/?$' ) and equals(%{LOCAL_SERVER_NAME}, 'home:8180' )" /> </host> </server> <filters> <rewrite name= "to-query0" target= "/somepath?param=1234" /> <expression-filter name= "to-query1" expression= "rewrite( '/somepath?param=1234' )" /> <expression-filter name= "to-query2" expression= "rewrite( '/somepath' ); set(attribute= '%{q,param}' , value= '1234' )" /> <expression-filter name= "to-query3" expression= "rewrite( '/somepath' ); set(attribute= '%{QUERY_STRING}' , value= 'param=1234' )" /> <expression-filter name= "to-query4" expression= "set(attribute= '%{RELATIVE_PATH}' , value= '/somepath' ); set(attribute= '%{QUERY_STRING}' , value= 'param=1234' )" /> </filters> </subsystem> Results of the different filters: // erroneous to-query0: /somepath?param=1234??param=1234 to-query1: /somepath?param=1234??param=1234 to-query2: /somepath // as expected to-query3: /somepath?param=1234 to-query4: /somepath?param=1234