diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/package.accept_keywords b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/package.accept_keywords
index df1f0eec6c..524d380943 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/package.accept_keywords
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/package.accept_keywords
@@ -1,6 +1,5 @@
 # arm64 keywords
 
-net-misc/curl ~arm64
 dev-libs/nspr ~arm64
 sys-apps/coreutils ~arm64
 app-text/asciidoc ~arm64
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
index 9e5ba416bb..e746a96c63 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
@@ -94,3 +94,7 @@ dev-util/checkbashisms
 # use this wget to get slotted openssl dep.
 =net-misc/wget-1.17.1-r1 ~amd64 ~arm64
 
+# avoid curl vulnerability 38/39
+# https://curl.haxx.se/docs/security.html
+=net-misc/curl-7.47.1 ~amd64 ~arm64
+