Index: contrib/sendmail/src/envelope.c
===================================================================
--- contrib/sendmail/src/envelope.c
+++ contrib/sendmail/src/envelope.c
@@ -323,7 +323,7 @@

                        /* don't free, allocated from e_rpool */
                        e->e_message = sm_rpool_strdup_x(e->e_rpool, buf);
-                       message(buf);
+                       message("%s", buf);
                        e->e_flags |= EF_CLRQUEUE;
                }
                if (msg_timeout == MSG_NOT_BY)
@@ -420,7 +420,7 @@
                                /* don't free, allocated from e_rpool */
                                e->e_message = sm_rpool_strdup_x(e->e_rpool,
                                                                 buf);
-                               message(buf);
+                               message("%s", buf);
                                e->e_flags |= EF_WARNING;
                        }
                        if (msg_timeout == MSG_WARN_BY)
Index: contrib/sendmail/src/parseaddr.c
===================================================================
--- contrib/sendmail/src/parseaddr.c
+++ contrib/sendmail/src/parseaddr.c
@@ -218,7 +218,7 @@
                        msg = "Deferring message until queue run";
                if (tTd(20, 1))
                        sm_dprintf("parseaddr: queueing message\n");
-               message(msg);
+               message("%s", msg);
                if (e->e_message == NULL && e->e_sendmode != SM_DEFER)
                        e->e_message = sm_rpool_strdup_x(e->e_rpool, msg);
                a->q_state = QS_QUEUEUP;
Index: contrib/sendmail/src/srvrsmtp.c
===================================================================
--- contrib/sendmail/src/srvrsmtp.c
+++ contrib/sendmail/src/srvrsmtp.c
@@ -578,13 +578,13 @@
                                bool tsave = QuickAbort;                \
                                                                        \
                                QuickAbort = false;                     \
-                               usrerr(response);                       \
+                               usrerr("%s", response);                 \
                                QuickAbort = tsave;                     \
                                e->e_sendqueue = NULL;                  \
                                goto doquit;                            \
                        }                                               \
                        else                                            \
-                               usrerr(response);                       \
+                               usrerr("%s", response);                 \
                        break;                                          \
                                                                        \
                  case SMFIR_REJECT:                                    \
@@ -931,7 +931,7 @@
        }
        else if (strncmp(nullserver, "421 ", 4) == 0)
        {
-               message(nullserver);
+               message("%s", nullserver);
                goto doquit;
        }

@@ -1849,7 +1849,7 @@
                                if (nullserver != NULL)
                                {
                                        if (ISSMTPREPLY(nullserver))
-                                               usrerr(nullserver);
+                                               usrerr("%s", nullserver);
                                        else
                                                usrerr("550 5.0.0 %s",
                                                       nullserver);
@@ -2452,7 +2452,7 @@
                                        tempfail = true;
                                        smtp.sm_milterize = false;
                                        if (response != NULL)
-                                               usrerr(response);
+                                               usrerr("%s", response);
                                        else
                                                message("421 4.7.0 %s closing connection",
                                                        MyHostName);
@@ -3659,7 +3659,7 @@
                                (void) extenhsc(response + 4, ' ', e->e_enhsc);
 #endif /* _FFR_MILTER_ENHSC */

-                       usrerr(response);
+                       usrerr("%s", response);
                        if (strncmp(response, "421 ", 4) == 0
                            || strncmp(response, "421-", 4) == 0)
                        {
@@ -3779,7 +3779,7 @@
                        if (ISSMTPCODE(response))
                                (void) extenhsc(response + 4, ' ', e->e_enhsc);
 #endif /* _FFR_MILTER_ENHSC */
-                       usrerr(response);
+                       usrerr("%s", response);
                        if (strncmp(response, "421 ", 4) == 0
                            || strncmp(response, "421-", 4) == 0)
                                rv = false;