Hi Roshan,
It is not aem instead JDK restricting the RFC2396. The caller should encode the url. As an workaround you can have filter by making use of URLEncoder and URLDecoder to overcome such issue which happens with external integration. Anyway infinite loop might be your custom implementation like rewriter, other packages causing it because i am not able to reproduce on out of the box. If you are able to reproduce without custom implementation, then report to official support team to get a fix.
Thanks,