A vulnerability in aiohttp causes host-only cookies saved and later restored via CookieJar persistence to lose their host-only attribute. This results in cookies being sent to subdomains that should not receive them, potentially exposing sensitive session data. The issue affects versions >=8.11.0 <9.9.0 and >=9.11.0 <10.0.3_1 and has been fixed in versions 9.9.0 and 10.0.3_1. The vulnerability has a high severity rating with a CVSS score of 7.5.