CVE-2026-54279 is a vulnerability in aiohttp's CookieJar persistence mechanism where host-only cookies lose their host-only status after being saved and restored. This causes cookies intended only for a specific host to be sent to its subdomains, potentially exposing sensitive cookie data. The issue affects versions >=2.0.5 and <2.1.0_11 of the affected product. A patch is available in version 2.1.0_11.