A vulnerability in aiohttp's CookieJar persistence causes host-only cookies saved to disk and later restored to lose their host-only status. This results in cookies being sent to subdomains that should not receive them, potentially exposing sensitive session information. The issue affects versions >=2.0.615 <3.2.530_1 and >=3.3.0 <3.3.10. A fix is available in versions 3.2.530_1 and 3.3.10.