We have re2c 2.0.3 in openSUSE:Factory now so it's been fixed there. I'm reassigning it back to the security team.