---
id: "cpe23"
kind: "datatype"
status: "draft"
is_pii: false
categories: ["software"]
langs: ["common"]
quality: 75
url: "http://registry.apicrafter.io/datatype/cpe23"
---

# CPE 2.3 formatted string (`cpe23`)

> **Draft.** Draft records have not been reviewed yet and may be incomplete or wrong; do not treat them as authoritative for legal or compliance decisions.

Name of an IT product in the formatted string binding of Common Platform Enumeration (CPE) 2.3, maintained by NIST: cpe:2.3: followed by eleven colon-separated attributes - part (a for an application, o for an operating system, h for hardware), vendor, product, version, update, edition, language, sw_edition, target_sw, target_hw and other. An asterisk means any value and a hyphen means not applicable. The NVD CPE dictionary and CVE records name affected products this way. The regexp is the one of the CPE 2.3 naming XML schema. The older CPE 2.2 URI form (cpe:/a:...) is not covered.

- Personal data (PII): no
- Categories: Software development (software)
- Countries: global
- Languages: Common to most languages (common)
- Classification: identifier

## Detection

Regular expression (Python `re`):

```
^cpe:2\.3:[aho*\-](:(((\?*|\*?)([a-zA-Z0-9\-._]|(\\[\\*?!"#$%&'()+,/:;<=>@\[\]\^`{|}~]))+(\?*|\*?))|[*\-])){5}(:(([a-zA-Z]{2,3}(-([a-zA-Z]{2}|[0-9]{3}))?)|[*\-]))(:(((\?*|\*?)([a-zA-Z0-9\-._]|(\\[\\*?!"#$%&'()+,/:;<=>@\[\]\^`{|}~]))+(\?*|\*?))|[*\-])){4}$
```

## Examples

- `cpe:2.3:a:apache:log4j:2.14.1:-:*:*:*:*:*:*` — Apache Log4j 2.14.1 in the NVD CPE dictionary
- `cpe:2.3:o:linux:linux_kernel:5.10:-:*:*:*:*:*:*` — Linux kernel 5.10 (operating system)
- `cpe:2.3:h:cisco:asa_5505:-:*:*:*:*:*:*:*` — Cisco ASA 5505 (hardware)
- `cpe:2.3:a:microsoft:internet_explorer:8.0.6001:beta:*:*:*:*:*:*` — Example from Wikipedia
- `cpe:/a:apache:log4j:2.14.1` (invalid example) — CPE 2.2 URI binding
- `cpe:2.3:a:apache:log4j:2.14.1` (invalid example) — Attributes after version are missing

## Sources

- wikipedia: <https://en.wikipedia.org/wiki/Common_Platform_Enumeration>
- doc: <https://csrc.nist.gov/schema/cpe/2.3/cpe-naming_2.3.xsd>
- doc: <https://nvd.nist.gov/products/cpe>

## Quality

Score 75/100. Missing: mapping (Wikidata, Schema.org, ...), translation, detector coverage.

JSON: <http://registry.apicrafter.io/api/v1/datatypes/cpe23.json> · Edit: <https://github.com/apicrafter/metacrafter-registry/edit/main/data/datatypes/any/software/cpe23.yaml>