--- httpd-2.2.x/modules/proxy/mod_proxy_balancer.c	(revision 1438130)
+++ httpd-2.2.x/modules/proxy/mod_proxy_balancer.c	(working copy)
@@ -716,11 +716,21 @@ 
                 if ((tok = ap_strchr(val, '&')))
                     *tok++ = '\0';
                 /*
-                 * Special case: workers are allowed path information
+                 * IPv6 address backends contain [ ] characters which are
+                 * escaped as %5b %5d *twice*, so we need to unescape them
+                 * twice.
+                 * 2013-02-08
+                 * bpkroth
+                 * https://issues.apache.org/bugzilla/show_bug.cgi?id=53736
                  */
-                if ((access_status = ap_unescape_url(val)) != OK)
-                    if (strcmp(args, "w") || (access_status !=  HTTP_NOT_FOUND))
-                        return access_status;
+                for (i = 1; i <= 2; i++) {
+                        /*
+                         * Special case: workers are allowed path information
+                         */
+                        if ((access_status = ap_unescape_url(val)) != OK)
+                            if (strcmp(args, "w") || (access_status !=  HTTP_NOT_FOUND))
+                                return access_status;
+                }
                 apr_table_setn(params, args, val);
                 args = tok;
             }