Redis's workaround for CVE-2026-25243 is an ACL rule that stops users from running RESTORE. On Redis 6+: ACL SETUSER <app-user> -restore for each application user, and do the same for default if apps log in with it. Then persist the change with ACL SAVE (if you use an aclfile) or CONFIG REWRITE. Check with ACL GETUSER <user> and by running a test RESTORE as that user; it should fail with NOPERM. Before you apply it, find out what legitimately uses RESTORE: cluster resharding and MIGRATE (the target side runs RESTORE), some backup and migration tools, and DUMP/RESTORE-based copy scripts. Give those a separate, tightly scoped user rather than leaving RESTORE open to every app. This is a stopgap. Upgrading to a fixed release (6.2.22, 7.2.14, 7.4.9, 8.2.6, 8.4.3, 8.6.3, or your distro's patched package) is the real fix, and it also covers the RESTORE bugs in the RedisTimeSeries and RedisBloom modules.