A vulnerability in aiohttp's CookieJar causes host-only cookies saved to disk and later restored to lose their host-only attribute. This results in these cookies being sent to subdomains where they should not be sent, potentially exposing sensitive session information. The issue affects versions 3.2.0 and later. A patch is available to correct this behavior.