A vulnerability in aiohttp causes host-only cookies saved and later restored via CookieJar persistence to lose their host-only attribute. This results in cookies being sent to subdomains that should not receive them, potentially exposing sensitive session data. The issue affects versions from 0.2.0 up to but not including 0.4.0_5. A patch is available in version 0.4.0_5.