A vulnerability in aiohttp causes host-only cookies saved and later restored via CookieJar persistence to lose their host-only attribute. This results in cookies being sent to subdomains that should not receive them, potentially exposing sensitive cookie data. The issue affects versions starting from 0.47.1. A patch is available to address this behavior.