A vulnerability in aiohttp's CookieJar causes host-only cookies saved to disk and later restored to lose their host-only attribute. This results in these cookies being sent to subdomains where they should not be sent, potentially exposing cookie data beyond the intended scope.