I looked at the documentation for cpe Naming Specification Version 2.3

http://csrc.nist.gov/publications/nistir/ir7695/NISTIR-7695-CPE-Naming.pdf

Specification says, "*" or "-" is explained as "ANY" or "NA", but "?" The mark is simply a special character that can be handled by other CPE specifications. "?", "??" It appears that these two cases can be used, but I wonder if this has the same meaning as regular expressions. Then I wonder why they didn't write that down in the specification document.