diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
index ea3c06b2f3..12f380d33f 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
@@ -23,9 +23,10 @@ dev-util/checkbashisms
 # Older versions of sssd fail to build
 =sys-auth/sssd-1.13.1 ~amd64 ~arm64
 
-# heap overflow fix
+# jq 1.5-r2 for heap overflow fix
 # https://bugs.gentoo.org/show_bug.cgi?id=580606
-=app-misc/jq-1.5-r2 ~amd64 ~arm64
+# jq 1.6-r3 for CVE-2015-8863
+>=app-misc/jq-1.5-r2 ~amd64 ~arm64
 
 # Must use the same version across all architectures
 =dev-libs/protobuf-2.6.1-r3