diff --git a/http_parser.c b/http_parser.c
index 8b65b45..bbe9bb0 100644
--- a/http_parser.c
+++ b/http_parser.c
@@ -739,6 +739,9 @@ size_t http_parser_execute (http_parser *parser,
         if (USUAL(ch)) break;
 
         switch (ch) {
+          case '?':
+            // allow extra '?' in query string
+            break;
           case ' ':
             CALLBACK(url);
             CALLBACK(query_string);
diff --git a/test.c b/test.c
index 5d0b3bd..c9d9c85 100644
--- a/test.c
+++ b/test.c
@@ -423,6 +423,26 @@ const struct message requests[] =
   ,.body= ""
   }
 
+#define QUERY_URL_WITH_QUESTION_MARK_GET 14
+/* Some clients include '?' characters in query strings.
+ */
+, {.name = "query url with question mark"
+  ,.type= HTTP_REQUEST
+  ,.raw= "GET /test.cgi?foo=bar?baz HTTP/1.1\r\n\r\n"
+  ,.should_keep_alive= TRUE
+  ,.message_complete_on_eof= FALSE
+  ,.http_major= 1
+  ,.http_minor= 1
+  ,.method= HTTP_GET
+  ,.query_string= "foo=bar?baz"
+  ,.fragment= ""
+  ,.request_path= "/test.cgi"
+  ,.request_url= "/test.cgi?foo=bar?baz"
+  ,.num_headers= 0
+  ,.headers= {}
+  ,.body= ""
+  }
+
 , {.name= NULL } /* sentinel */
 };