update 2.7 release notes wrt #2326 patch

cowtowncoder · cowtowncoder · commit b59636510989 · 2019-05-28T13:36:11.000-07:00
diff --git a/release-notes/VERSION b/release-notes/VERSION
@@ -4,6 +4,11 @@ Project: jackson-databind
 === Releases ===
 ------------------------------------------------------------------------
 
+Not yet released
+
+#2326: Block class for CVE-2019-12086
+ (contributed by MaximilianTews@github)
+
 2.7.9.5 (23-Nov-2018)
 
 #1899: Another two gadgets to exploit default typing issue in jackson-databind
