A vulnerability in aiohttp versions prior to 3.14.1 causes host-only cookies saved and later restored via CookieJar persistence to lose their host-only status. This results in cookies being sent to subdomains that should not receive them, potentially exposing sensitive session data. The issue is fixed in version 3.14.1.