A vulnerability in aiohttp causes host-only cookies saved and later restored via CookieJar persistence to lose their host-only attribute. This results in cookies being sent to subdomains that should not receive them. The issue affects versions from 3.13.0 up to but not including 5.29.3. A patch is available in version 5.29.3 to correct this behavior.