cpe

What it is and what it does

CPE is a Python implementation of the Common Platform Enumeration standard developed by MITRE and maintained by NIST. It provides tools to parse, compare, and evaluate CPE identifiers—standardized names for applications, operating systems, and hardware devices used in enterprise asset management and vulnerability tracking. The package handles three CPE formats (WFN, URI, and FS) and supports rich comparison operations and cross-version conversion between CPE versions 1.1, 2.2, and 2.3.

The package has no runtime dependencies, making it lightweight for integration into security tools, asset inventory systems, and vulnerability scanners. However, it requires installation from source (high friction), and its maintenance status is aging. The LGPLv3 license is copyleft, meaning any derivative work must also be open-source and GPL-compatible.

Use it for:

• Parse and normalize CPE identifiers in vulnerability databases or asset management systems.
• Compare CPE strings to match software and hardware across different naming conventions.
• Evaluate CPE matching logic in security scanning tools that need to identify affected assets.
• Convert between CPE format versions (1.1, 2.2, 2.3) when integrating legacy and modern systems.
• Build asset classification and inventory tools that rely on standardized platform enumeration.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Parses, compares, and evaluates Common Platform Enumeration (CPE) identifiers in WFN, URI, and FS formats according to MITRE/NIST standards.

Yes, with conditions. Install if you need CPE parsing and matching for security or asset management workflows and can accept the LGPLv3 copyleft constraint. The package is stable and dependency-free, but verify Python version compatibility before use—classifiers suggest Python 2.7 only, which is unmaintained. The high install friction and aging maintenance status mean you should confirm the package still works with your target Python version and CPE specification version before committing to it.

Install

cpe on PyPI

pip install cpe

uv add cpe

poetry add cpe

Installing cpe

Before you install

High install friction due to source distribution. Package is aging but repository remains active with recent commits; classifiers indicate Python 2.7 support, suggesting limited modern Python version coverage.

License in practice

LGPLv3 copyleft license requires derivative works to be licensed under compatible terms and source code to be made available; suitable for internal tools and open-source projects but restrictive for proprietary software.

Quickstart

pip install cpe

from cpe.cpe import CPE

cpe_obj = CPE('cpe:/a:vendor:product:1.0')
print(cpe_obj)

Classifiers indicate Python 2.7 support; modern Python version compatibility is unspecified and may require verification.

Verify before relying

• Whether the package supports Python 3.x versions beyond what classifiers suggest (2.7 listed, but 3.4 mentioned in description).
• Current state of Python 2.7 support given its end-of-life status and the package's aging maintenance window.
• Whether WFN, URI, and FS format support is complete and tested against current CPE 2.3 specification.

Package facts

Evidence: cpe-1.3.1.tar.gz

Keywords: cpe, identification, naming, matching, standard, specification, mitre, nist

Tags

More Security packages