# Topic about extending CPE or PURL to support LLM models

**URL:** https://discourse.ossbase.org/t/topic-about-extending-cpe-or-purl-to-support-llm-models/1106
**Category:** GCVE
**Created:** [June 23, 2026, 2:02pm UTC](https://discourse.ossbase.org/t/topic-about-extending-cpe-or-purl-to-support-llm-models/1106 "2026-06-23T14:02:28Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![adulau](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/adulau/32/6_2.png) [@adulau](https://discourse.ossbase.org/u/adulau)
#### Post date: [June 23, 2026, 2:02pm UTC](https://discourse.ossbase.org/t/topic-about-extending-cpe-or-purl-to-support-llm-models/1106/1 "2026-06-23T14:02:28Z")

</div>

After a discussion with Eireann Leverett in a chat room about fingerprinting, he asked how LLM software and tools should be classified by default. Is there an appropriate CPE vendor/product classification for them?

The key question is what exactly is being identified.

If the vulnerability affects an LLM service, the scope appears to be already covered by existing CPE entries:

> **[GCVE - Product Chatgpt](https://cpe.gcve.eu/products/dffef550-f776-5faa-802e-51a37ade5656)**

However, consider a model produced by OpenAI, such as:

> **[GitHub - openai/gpt-oss: gpt-oss-120b and gpt-oss-20b are two open-weight...](https://github.com/openai/gpt-oss)**
>
> gpt-oss-120b and gpt-oss-20b are two open-weight language models by OpenAI

If the vulnerability is within the model itself, I would assume a CPE such as `openai:gpt-oss` could be appropriate. Could the same CPE also be used for other use cases, such as AI-assisted materials produced with that model? I believe it could.

This raises a governance question: if the vendor is not willing to assign a CPE, should CPE.GCVE.EU create one? Alternatively, should we assign a dedicated vendor namespace for such cases?