CPE (Common Platform Enumeration) Generation

CPE 2.3 identifiers are generated for CVEAffected entries that lack upstream CPE data. They follow the NIST IR 7695 specification for Well-Formed Names and enable consumers to match vulnerabilities against product inventories using standard CPE matching algorithms.

Architecture

CPE 2.3 Format

The CPE 2.3 formatted string has exactly 13 colon-separated components:

cpe:2.3:<part>:<vendor>:<product>:<version>:<update>:<edition>:<language>:<sw_edition>:<target_sw>:<target_hw>:<other>

* = “any value” (wildcard). - = “not applicable”.

Normalisation Rules

Character Escaping

The following characters are backslash-escaped per NIST IR 7695 section 6.2:

! " # $ % & ' ( ) * + , / : ; < = > ? @ [ \ ] ^ ` { | } ~

Characters that are NOT escaped (commonly appear in valid CPE values):

• Period . — common in version strings (e.g., 2.4.51)
• Hyphen - — common in product names (e.g., http-server)
• Underscore _ — used as space replacement

Examples

Vendor Suffix Stripping

Before CPE generation, vendor names have corporate suffixes removed for better matching against NVD’s CPE dictionary (1.6M+ entries):

Generation Conditions

CPE generation runs in these contexts:

1. v2_affected endpoint — for each CVEAffected row where cpes is null/empty
2. package_search endpoint — from the vendor/product fields in enrichment data
3. v2_cloud_locators endpoint — standalone CPE generation from query parameters
4. Synthesized entries — when no CVEAffected exists, generated from title-derived services

Parsing (Round-trip)

ParseCPE23() decomposes a CPE 2.3 string back into its components, handling backslash-escaped colons within field values:

Input:  cpe:2.3:a:vendor\:name:product:1.0:*:*:*:*:*:*:*
Output: CPEComponents{
    Part:    "a",
    Vendor:  "vendor\:name",  ← escaped colon preserved
    Product: "product",
    Version: "1.0",
    ...remaining fields: "*"
}

The parser splits on unescaped colons (colons not preceded by \) to correctly handle vendor/product names containing literal colons.

Deduplication

DeduplicateCpes() is applied as the last step before response and persistence:

1. Parse existing cpes JSON array from CVEAffected
2. Track seen CPE strings in a set
3. Preserve insertion order (first occurrence wins)
4. Append generated CPE only if not already present
5. Return the deduplicated array

The generated CPE (* version) is only added if not already present. Upstream CPEs with specific versions are preserved and take precedence.

Persistence

Generated CPEs are written back to CVEAffected.cpes asynchronously:

1. Read current cpes value from DB
2. Parse existing JSON array
3. Check if generated CPE already present (dedup)
4. Append if new, marshal to JSON
5. UPDATE the row

This runs in a fire-and-forget goroutine so the API response is not blocked.

CPE Dictionary Sources

Key Files