A vulnerability in aiohttp's CookieJar persistence causes host-only cookies saved and later restored from disk to lose their host-only attribute. This results in cookies being sent to subdomains where they should not be sent, potentially exposing sensitive cookie data. The issue affects versions from 5.14.0_13 up to but not including 5.14.0_14. A patch is available in version 5.14.0_14 that addresses this behavior.