A vulnerability in aiohttp's CookieJar persistence causes host-only cookies saved to disk and later restored to lose their host-only status. This results in cookies being sent to subdomains that should not receive them, potentially exposing sensitive session data. The issue affects versions >=1.8.1 <1.8.2 and >=2.0.1 <3.67.1_7. A patch is available in versions 1.8.2 and 3.67.1_7.