diff --git a/changes-entries/h2-proxy-link-map-off-by-one.txt b/changes-entries/h2-proxy-link-map-off-by-one.txt
new file mode 100644
index 00000000000..15a61e68676
--- /dev/null
+++ b/changes-entries/h2-proxy-link-map-off-by-one.txt
@@ -0,0 +1,3 @@
+  *) mod_proxy_http2: Reserve room for the terminating NUL when rewriting a
+     backend Link response header, fixing a one-byte stack overflow reachable
+     with a crafted Link header.  [arshiya tabasum]
diff --git a/modules/http2/h2_proxy_util.c b/modules/http2/h2_proxy_util.c
index ea9da14ee89..b7a4c509107 100644
--- a/modules/http2/h2_proxy_util.c
+++ b/modules/http2/h2_proxy_util.c
@@ -976,7 +976,7 @@ static void map_link(link_ctx *ctx)
              * to work, we need to use the proxy uri */
             int path_start = ctx->link_start + ctx->rbu_len;
             link_len -= ctx->rbu_len;
-            need_len = ctx->psu_len + link_len;
+            need_len = ctx->psu_len + link_len + 1;
             if (need_len > sizeof(buffer))
                 goto out;
             memcpy(buffer, ctx->p_server_uri, ctx->psu_len);