A vulnerability in aiohttp's CookieJar persistence causes host-only cookies saved to disk and later restored to lose their host-only attribute. This results in cookies being sent to subdomains that should not have received them, potentially exposing sensitive session data. The issue affects versions from 2026.4.30 up to but not including 2026.5.16_1. A patch is available in version 2026.5.16_1 to correct this behavior.