A vulnerability in aiohttp's CookieJar causes host-only cookies saved to disk and later restored to lose their host-only status. This results in these cookies being sent to subdomains where they should not be sent, potentially exposing sensitive cookie data. The issue affects versions from 1.2.1 up to but not including 1.3.1_10. A patch is available in version 1.3.1_10 that addresses this flaw.