How are Servlet url mappings in web.xml used?

From Servlet 3.0 specification, this is how the web container must locate the servlet after receiving a request (emphasis mine):

The path used for mapping to a servlet is the request URL from the
request object minus the context path and the path parameters. The
URL path mapping rules below are used in order. The first successful
match is used with no further matches attempted:

1. The container will try to find an exact match of the path of the request to the path of the servlet. A successful match selects the
   servlet.
2. The container will recursively try to match the longest path-prefix. This is done by stepping down the path tree a directory
   at a time, using the ’/’ character as a path separator. The longest
   match determines the servlet selected.
3. If the last segment in the URL path contains an extension (e.g. .jsp), the servlet container will try to match a servlet that handles
   requests for the extension. An extension is defined as the part of
   the last segment after the last ’.’ character.
4. If neither of the previous three rules result in a servlet match, the container will attempt to serve content appropriate for the
   resource requested. If a “default” servlet is defined for the
   application, it will be used. Many containers provide an implicit
   default servlet for serving content.

The container must use case-sensitive string comparisons for matching.

You should also look the specification of mappings (given below):

In the Web application deployment descriptor, the following syntax is
used to define mappings:

• A string beginning with a ‘/’ character and ending with a ‘/*’ suffix
  is used for path mapping.

• A string beginning with a ‘*.’ prefix is used as an extension mapping.

• The empty string ("") is a special URL pattern that exactly maps to
  the application’s context root, i.e., requests of the form
  http://host:port/<contextroot>/. In this case the path info is ’/’ and
  the servlet path and context path is empty string (““).

• A string containing only the ’/’ character indicates the “default”
  servlet of the application. In this case the servlet path is the
  request URI minus the context path and the path info is null.

• All other strings are used for exact matches only

Let us look at examples now. Consider the following set of mappings:

Path Pattern            Servlet
/foo/bar/*              servlet1
/baz/*                  servlet2
/catalog                servlet3
*.bop                   servlet4

The following behavior would result:

Incoming Path           Servlet Handling Request
/foo/bar/index.html     servlet1
/foo/bar/index.bop      servlet1
/baz                    servlet2
/baz/index.html         servlet2
/catalog                servlet3
/catalog/index.html     “default” servlet
/catalog/racecar.bop    servlet4
/index.bop              servlet4

Note that in the case of /catalog/index.html and /catalog/racecar.bop, the
servlet mapped to “/catalog” is not used because the match is not exact.

Now coming to your problem 🙂

/path/test belongs to the 5th point of specification of mappings. Which means only the paths ending in /path/test will target servlet1.

However /path/test/* qualifies for the first point of the same specification. This means that:

.../path/test will be handled by servlet1 and

.../path/test/abc will be handled by servlet2

Which was verified by me in a test application.